Practical Windows Kernel Exploitation

Explore Windows kernel exploitation techniques in this 45-minute conference talk from Derbycon 2015. Dive into improving reliability, common vulnerability classes, and mitigation technologies. Learn about WND Object exploitation, Metasploit implementations, and environment detection. Understand sources of instability, corrupted structures, and token reference counts. Gain insights on Windows Local Privilege Escalation and closing thoughts on Windows 10 Win32. Enhance your knowledge of practical Windows kernel exploitation with speaker Spencer McIntyre.

Syllabus

Intro
Agenda
Improving Reliability
Why Exploit
Google Security Research
Common Vulnerability Classes
What is it
How to exploit it
How to replace it
WND Object
Mitigation Technologies
No Page Mapping
Disabling SMS
Metasploit
Ruby
Sea implementations
Environment detection
Shellcode
Source of instability
Corrupted structures
Token reference count
Returning control
System Service Post Call
Return on Success
Windows Local Privilege Escalation
Closing Thoughts
Windows 10 Win32